3 ms·
sounds like someone needs to set his X-Frame-Options header.
by beckler 11y ago
sounds like someone needs to set his X-Frame-Options header.
- jrs235 11y agoThank you for this. I was unaware of such an option! Here's a nice clickjacking cheat sheet I found after searching for more info: https://www.owasp.org/index.php/Clickjacking_Defense_Cheat_Sheet https://www.owasp.org/index.php/Clickjacking_Defense_Cheat_S...
- drostie 11y agoUnfortunately that would not work in this case: in this case they created an unauthorized copy of the work on their own server for the purposes of redistribution; therefore they had full control over the HTTP headers.
- nkrisc 11y agoEncode and eval the alert code so it's at least harder than searching the source for "alert"? It's not good, but it might be enough to annoy them into not doing it. Probably not.